Tenda CVE-2026-4535

Tenda FH451 firmware version 1.0.0.9. Requires authenticated access (PR:L) to send crafted POST request to /goform/WrlclientSet endpoint with malicious GO parameter. No user interaction needed. Remote exploitation via network.

The CVSS score of 8.8 (High) is justified by the network attack vector (AV:N), low attack complexity (AC:L), and high impact across all CIA triad dimensions. However, the vulnerability requires low-level authentication (PR:L), which somewhat reduces the attack surface compared to unauthenticated vulnerabilities. The existence of a publicly available proof-of-concept exploit (https://github.com/Litengzheng/vul_db/blob/main/FH451/vul_42/README.md) significantly elevates real-world risk, as attackers can leverage ready-made code. The CVSS temporal metrics show Proof-of-Concept exploitation code exists (E:P) with remediation level unspecified (RL:X) and reasonable report confidence (RC:R). While not currently listed in CISA KEV, the combination of public exploit availability, network accessibility, and the prevalence of Tenda routers in SOHO environments makes this a genuine priority for organizations using affected devices. The requirement for authentication provides some barrier, but default or weak credentials are common in consumer routers, making this exploitable at scale.

An attacker with knowledge of valid router credentials (obtained through credential stuffing, default passwords, or social engineering) authenticates to the Tenda FH451 web interface over the network. Using the publicly available proof-of-concept code from GitHub, the attacker sends a specially crafted HTTP request to /goform/WrlclientSet with an oversized 'GO' parameter that triggers the stack-based buffer overflow, allowing the attacker to execute arbitrary code with the privileges of the web server process and potentially gain full control of the router to intercept traffic, pivot to internal networks, or establish persistent access.